Chet Hosmer - Python Forensics [2014, PDF, ENG]

Figure 1.1 Narrowing the gap 3
Figure 1.2 The future digital crime scene 4
Figure 1.3 Data vs. semantics 5
Figure 1.4 The next-generation cyber warrior 5
Figure 1.5 Programming language popularity according to codeview.com 7
Figure 1.6 Test-then code-then validate 7
Figure 2.1 The Python Programming Language Official Web site 17
Figure 2.2 Downloading the Windows installer 18
Figure 2.3 Windows download confirmation 18
Figure 2.4 Executing the Python 2.7.5 Installer 19
Figure 2.5 Python Installation user selection 20
Figure 2.6 Python Installation directory 20
Figure 2.7 Python customization user manual 21
Figure 2.8 TCL/TK install when needed 21
Figure 2.9 Windows user account control 22
Figure 2.10 Successful installation of Python 2.7.5 22
Figure 2.11 Python directory snapshot 23
Figure 2.12 Windows taskbar with Python icon 23
Figure 2.13 Python startup prompt and messages 24
Figure 2.14 Python Hello World 24
Figure 2.15 Windows execution of hashPrint.py 26
Figure 2.16 Ubuntu Linux execution of hashPrint.py 27
Figure 2.17 Python Shell session using hex() and bin() 27
Figure 2.18 Python Shell session entering hex values 28
Figure 2.19 Python Shell creating lists using the range() built-in
Standard Library function 28
Figure 2.20 ipRange execution 29
Figure 2.21 Built-in True and False constants 31
Figure 2.22 Python is not a strongly typed language 31
Figure 2.23 Apply an Exclusive OR (XOR) 33
Figure 2.24 Example using the os module from the Standard Library 35
Figure 2.25 Python IDLE integrated development environment 38
Figure 2.26 Snapshot of WingIDE 4.1 Personal 40
Figure 2.27 WingIDE Python Shell display 40
Figure 2.28 WingIDE in action 41
Figure 2.29 Using WingIDE to step through code 42
Figure 2.30 WingIDE examination of the completed list 43
Figure 2.31 WingIDE auto complete feature 43
Figure 2.32 Ubuntu download Web page 12.04 LTS 44
Figure 2.33 Ubuntu terminal window Python command 45
Figure 2.34 Ubuntu software center 45
Figure 2.35 WingIDE running on Ubuntu 12.04 LTS 46
Figure 2.36 Python Shell running on iOS 47
Figure 2.37 iOS implementation of HashPrint 48
Figure 2.38 Apple App Store page regarding Python for iOS 48
Figure 2.39 Windows 8 Phone screenshot of PyConsole launching 49
Figure 2.40 Python Console “Hello World” on a Windows 8 Phone 49
Figure 2.41 Windows 8 Phone HashPrint application execution 50
Figure 2.42 Python Console Windows App Store page 50
Figure 3.1 Cryptographic SmartCard 54
Figure 3.2 Context diagram: python-file system hashing (p-fish) 61
Figure 3.3 p-fish internal structure 62
Figure 3.4 p-fish WingIDE setup 64
Figure 3.5 Demonstration of ParseCommandLine 70
Figure 3.6 pfish –h command 70
Figure 3.7 Test run of pfish.py 84
Figure 3.8 Result directory after pfish execution 84
Figure 3.9 Examining the Result File with Microsoft Excel 85
Figure 3.10 Contents of the pFishLog file 86
Figure 3.11 Linux Command Line Execution 87
Figure 3.12 Linux Execution Results pfish Result File 88
Figure 3.13 Linux Execution Results pFishLog File 89
Figure 4.1 Snapshot of stackdata displaying the baTarget object and
the size in bytes of the baTarget bytearray 95
Figure 4.2 p-search context diagram 97
Figure 4.3 p-search internal structure 98
Figure 4.4 WingIDE p-search execution 99
Figure 4.5 p-search execution using only the -h or help option 102
Figure 4.6 Execution test directory for p-search 108
Figure 4.7 Keyword file dump 108
Figure 4.8 p-search sample execution 109
Figure 4.9 Log file contents post execution 109
Figure 4.10 Execution of p-search running on Ubuntu Linux 12.04 LTS 110
Figure 4.11 Execution of p-search running on iMac 111
Figure 4.12 Diagram of word weighting approach 111
Figure 4.13 Weighted characteristics illustration 112
Figure 4.14 p-search execution with indexing capability 115
Figure 5.1 Downloading Python Image Library for Windows 127
Figure 5.2 Windows installation Wizard for the Python Image Library 128
Figure 5.3 Installing Python Image Library on Ubuntu 12.04 LTS 129
Figure 5.4 Internet Photo Cat.jpg 135
Figure 5.5 Map of GPS coordinates extracted From Cat.jpg 138
Figure 5.6 p-gpsExtractor context diagram 140
Figure 5.7 WingIDE Project Overview 140
Figure 5.8 p-gpsExtractor.py execution 159
Figure 5.9 Mapping the coordinates extracted from photos 160
Figure 5.10 Map zoom into Western Europe 161
Figure 5.11 Map zoom to street level in Germany 162
Figure 5.12 Snapshot of Results.csv file 162
Figure 5.13 Snapshot of the Forensic Log file 163
Figure 6.1 John Harrison H1 clock 166
Figure 6.2 A very brief history of time 168
Figure 6.3 Python ntplib download page 174
Figure 6.4 Download of ntplib-0.3.1.tar.gz 175
Figure 6.5 Decompressed ntplib-0.3.1 176
Figure 6.6 Install ntplib 176
Figure 6.7 Verifying the installation 177
Figure 6.8 dir(ntplib) results 177
Figure 6.9 Partial list of NIST time servers 178
Figure 6.10 European NTP Pool Project 178
Figure 7.1 NLTK.org Installation url 185
Figure 8.1 Simplest local area network 206
Figure 8.2 Isolated localhost loopback 208
Figure 8.3 server.py/client.py program execution 211
Figure 8.4 Photo of the actual USS Dallas Los Angeles-class
nuclear-powered attack submarine 212
Figure 8.5 Command line launch of the guiPing.py as root 218
Figure 8.6 GUI interface for Ping Sweep 218
Figure 8.7 Ping Sweep execution 224
Figure 8.8 Error handling for misconfigured host range 225
Figure 8.9 Port Scanner GUI 228
Figure 8.10 Port Scanner program launch 228
Figure 8.11 Port Scanner execution with Display All selected 234
Figure 8.12 Port Scanner execution with Display NOT selected 234
Figure 9.1 SPAN port diagram 239
Figure 9.2 SPAN port connections 239
Figure 9.3 Raw TCP/IP packet contents 242
Figure 9.4 Typical IPv4 packet header 243
Figure 9.5 Typical TCP packet header 246
Figure 9.6 Typical UDP packet header 248
Figure 9.7 WingIDE environment for the PSNMT application 250
Figure 9.8 psnmt TCP sample run 259
Figure 9.9 psnmt UDP sample run 260
Figure 9.10 Sample TCP output file shown in Excel 261
Figure 9.11 Sample UDP output file shown in Excel 262
Figure 10.1 Plaintext Rainbow Table output abridged 287
Figure 11.1 Typical cloud configuration 290
Figure 11.2 Cloud execution from iPad 291
Figure 11.3 Desktop execution of the simple and multiprocessing
Python applications executing in the cloud 291
Figure 11.4 Python Anywhere Home Page 292
Figure 11.5 Python Anywhere Plans 293
Figure 11.6 PICloud Home Page 293
Figure 11.7 PICloud Plans 294
Figure 11.8 Digital Ocean Home Page 294
Figure 11.9 Digital Ocean Plans 294
Figure 11.10 Python Anywhere Single Core Execution Results 299
Figure 11.11 Python Anywhere Multi-Core Execution Results 299
Figure 11.12 Standalone Linux Single/Multi-Core Execution Results 299
Figure 11.13 elPassword 8-character combinations of lowercase letters 300
Figure 11.14 elPassword 8-character full ASCII character set 301
Figure 11.15 Last Bit calculation lowercase using 1 computer 301
Figure 11.16 Last Bit calculation lowercase using 100 computers 302
Figure 11.17 Last Bit calculation ASCII set using 100 computers 302
Figure 11.18 Last Bit calculation ASCII set using 10,000 computers 302
Figure 12.1 Multiprocessing in the Cloud 311
Figure 12.2 AMD 6300 Series 16 Core Processor 311
Figure 12.3 Intel Xeon E7 Series 10 Core 20 Thread Processor 311